Add explicit permissions block to test-all.yml

Set top-level `contents: read` to satisfy CodeQL requirements.
The rerun-failed-jobs job gets a job-level override adding
`actions: write` since it needs to trigger retry-workflow.yml.

Author: cipolleschi

.github/workflows/test-all.yml

@@ -8,6 +8,9 @@ on:
       - main
       - "*-stable"
 
+permissions:
+  contents: read
+
 jobs:
   set_release_type:
     runs-on: ubuntu-latest
@@ -510,6 +513,9 @@ jobs:
   # This job only handles Fantom test retries on main.
   rerun-failed-jobs:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
     needs: [run_fantom_tests]
     if: ${{ github.ref == 'refs/heads/main' && always() }}
     steps: